7 ms·

LinkedIn suffers DNS hijack

210 points by mikegreenspan 13y ago

TheBurningOr 13y ago
Does anyone have any corroboration of this?
- moondogg 13y ago
  http://www.cio.co.ke/news/main-stories/google,-microsoft,-linkedin-hacked-in-kenyan-dns-hijack http://www.cio.co.ke/news/main-stories/google,-microsoft,-li...
  - glanotte 13y ago
    That is from April 15th.
- meatmanek 13y ago
  https://twitter.com/LinkedIn/status/347530092886519808 https://twitter.com/LinkedIn/status/347530092886519808
meritt 13y ago
Seeing 204.11.56.17 for their A record which is OrgName: Confluence Networks Inc OrgId: CN Address: 3rd Floor, Omar Hodge Building, Wickhams Address: Cay I, P.O. Box 362 City: Road Town StateProv: Tortola PostalCode: VG1110 Country: VG RegDate: 2011-04-07 Updated: 2011-07-05
- mindcrime 13y ago
  I'm getting 216.52.242.80. Looks legit: [prhodes@captainchaos ~]$ whois 216.52.242.80@whois.arin.net [Querying whois.arin.net] [whois.arin.net] # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # # Query terms are ambiguous. The query is assumed to be: # "n 216.52.242.80" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=216.52.242.80? showDetails=true&showARIN=false&ext=netref2 # LinkedIn Corporation INAP-LAX-LINKEDIN-38682 (NET-216-52- 242-0-1) 216.52.242.0 - 216.52.242.255 Internap Network Services Corporation PNAP-8-98 (NET-216-52-0-0-1) 216.52.0.0 - 216.52.255.255
- antsam 13y ago
  Doing an nslookup here in Vancouver, Canada got me this: Non-authoritative answer: Name: linkedin.com Address: 216.52.242.86 Does that mean I'm still pointing to the legitimate server?
hnolable 13y ago
I guess they didn't mark their cookies as 'Secure'. Oh well, the real story here is an app.net link at #1 on HN.
- chollida1 13y ago
  > Oh well, the real story here is an app.net link at #1 on HN. I can't tell if this is sarcasm or a serious comment. Could you elaborate on this comment? I don't get why a link by app.net would be news worthy.
  - heroic 13y ago
    I guess because it's not twitter!
  - hnolable 13y ago
    My understanding is app.net is trying to be a paid version of twitter. There was/is much debate whether it could ever take off. This is the first time I've ever seen someone link to it. Although now I realize that the link is to the app.net cofounder so that doesn't really say much.
    - millzlane 13y ago
      OP works there according to his twitter feed.
- coderrr 13y ago
  Looks like app.net isn't perfect either. Their HSTS isn't implemented correctly. Only 'alpha.app.net' and 'join.app.net' are protected while 'app.net' is not. They fell into one of the common pitfalls with their http->https redirects: http://coderrr.wordpress.com/2010/12/27/canonical-redirect-pitfalls-with-http-strict-transport-security-and-some-solutions/ http://coderrr.wordpress.com/2010/12/27/canonical-redirect-p... You can verify this at: chrome://net-internals/#hsts
- asdfaoeu 13y ago
  > Oh well, the real story here is an app.net link at #1 on HN. Looks like the app.net post was by a founder so I would take that with a grain of salt. Edit: While I'm at it according to https://twitter.com/mikegreenspan https://twitter.com/mikegreenspan , the submitter also works at app.net.
somid3 13y ago
well, certainly the photo upload still is not working, you can update your photo via their website apparently.
kcen 13y ago
The DNS was not exactly hijacked, there were issues inside of LinkedIn's top level DNS provider whom were delegating www.linkedin.com authorization to unauthorized nameservers, namely NS[SOMETHING].ztomy.com. The ztomy DNS replaces its delegated domains to point to a domain parking page if there is no record exiting. These changes were then propagated to other nameservers and thus to the end user. End result, dns doesn't point where you think it does.
- gravitronic 13y ago
  That makes sense since we just saw the same problem with USPS realtime shipping rates via production.shippingapis.com, which seems like an odd attack target. edit: and I mean the exact same issue, it was resolving to a confluence owned IP that was serving a squatter page for the domain.
- inopinatus 13y ago
  Au contraire; having the delegation going somewhere unwanted is practically the definition of a DNS hijack. The question is - how did that happen? A malicious third party? a blundering sysadmin? or a bug in some provisioning code? It does sound like LinkedIn's NOC are playing the blame game already. Well, I guess they've gotta get all those spamming recruiters & sales reps back online. EDIT: heh, maybe it was The New Guy: http://www.simplyhired.com/job-id/y5bvoz46k6 http://www.simplyhired.com/job-id/y5bvoz46k6
  - kcen 13y ago
    It's always the new guy, f'n new guy.
  - yannk 13y ago
    ahaha, the job posting is a good find. We'll know if you are right if tomorrow a different add asking for "Total badass, Expert guru knowledge of Bind 9"
- dsl 13y ago
  You used a lot of the right words, but not in the right context. Could you share your source do we can get the full picture?
raldi 13y ago
Can anyone think of a good reason LinkedIn didn't mark their cookies as HTTPS-only? http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly
- Raticide 13y ago
  They forgot?
- dsl 13y ago
  I often describe LinkedIn as a bunch of business people, who have a website. It's not a tech company and the hiring reflects that.
  - mncaudill 13y ago
    Seriously? http://blog.linkedin.com/2011/01/11/open-source-linkedin-kafka/ http://blog.linkedin.com/2011/01/11/open-source-linkedin-kaf... http://blog.linkedin.com/2009/03/20/project-voldemort-scaling-simple-storage-at-linkedin/ http://blog.linkedin.com/2009/03/20/project-voldemort-scalin...
  - darth_aardvark 13y ago
    I was an engineering intern there for a summer. The interviews were as difficult as any other tech company in the valley, as was the workload. It is most certainly a tech company.
  - memmove 13y ago
    dsl, no offense, but you seem to have a problem with any company that doesn't hire/provide employment to your average local community college CS grad and instead hires globally based purely on merit. Linkedin interviews are on par with facebook/google et al.
    - dsl 13y ago
      Really, now the sock puppets are coming out? I hire people purely on technical merit, I don't even bother reviewing educational credentials. I am opposed to abusing the H1-B system rather than opening offices overseas to bring in skilled labor and raise local standards of living.
bryanh 13y ago
Was api.linkedin.com compromised/hijacked? If so, that means they'll need to reset a lot of OAuth token/secrets which will be very painful indeed (worse than just a site-wide session reset).
- kcen 13y ago
  Isn't that the point of OAuth? (versus HTTP basic auth) Your secret key shouldn't be compromised, because you're supposed to keep that secret. Also if you use HTTPS for requests you'd still get a cert error even if DNS was routing incorrectly. You're probably fine.
  - bryanh 13y ago
    Indeed, I misspoke and meant to say tokens/refresh tokens. A similar thing happened for Evernote a while back and knocked down all tokens and required re-authentication across the board.
ioquatix 13y ago
I'm going to blatantly advertise my own project "RubyDNS" - it can be a lot of fun, and it is especially relevant because it allows you to perform these kinds of attacks in a controlled environment. http://www.codeotaku.com/projects/rubydns/index.en http://www.codeotaku.com/projects/rubydns/index.en
- dsl 13y ago
  Have you played with PowerDNS? It would be awesome to see RubyDNS rewritten as a backend.
  - ioquatix 13y ago
    Yeah, I've looked at it briefly. Well, RubyDNS already provides the full DNS server functionality, so I didn't really see the point. What do you think the main benefits would be?
mtam 13y ago
My traceroute is going thru prolexic.com so there might be something else at play here. "Prolexic is the world’s largest and most trusted distributed denial of service (DDoS) mitigation service provider"
mattbarrie 13y ago
Seems legit. www.ztomy.com
- dsl 13y ago
  ztomy.com is part of the DirectI/ResellerClub/etc. group of companies. They operate paid domain parking programs for registrars.
willlll 13y ago
How has app.net adoption been going?
thrownaway2424 13y ago
I guess it's a good thing I never reset my LinkedIn password after they lost them all, so I don't have a LinkedIn account to be hijacked.
krapp 13y ago
Someone turned off the 'more magic' switch...
djabatt 13y ago
DNS hacks on big public companies seems like a big security oversite form the linkedin team. wow. Perhaps my HTTPS anywhere extension could have helped folks.
- DoubleMalt 13y ago
  While I love your HTTPS anywhere extension and thought (cough) have it installed, I was dismayed that I was allowed to connect to http://www.linkedin.com/ http://www.linkedin.com/. Then I found out it wasn't synched over last time I changed laptops. Installing it now. Thanks for the great work!
- jgh 13y ago
  Is HTTPS Anywhere better than HTTPS Everywhere?
ChuckMcM 13y ago
Random anecdote: One of the DNS issues I tried to fix with NIS+ was the 'maintaining a list of trusted servers' problem by distributing the management of the authoritative servers. Trust was built bottom up, and authority came top down. The way it worked was that clients used a 'coldstart' file which was the (small number) of servers you trusted to provide your namespace lookups. You to their public key and you put it into your coldstart file. Similarly, a server put the key(s) of the servers it trusted above it in the name space in its coldstart file. And at company 'root' level was a set of servers run by a trusted authority. Locating the authoritative name server for x.y.z from p.q.z (same as DNS root is rightmost) client in x.y.z asks its server for a trusted y.z server, gets it, and asks that server for a trusted z. server, then asks that server for a q.z. server and finally for a p.q.z. server. Once this has happened once you know trusted servers can can jump to the nearest one to start resolving a new path in the namespace. It was slower on initial lookup and then just as fast as DNS on later ones. It had the downside that compromised (or borked) high level servers could send you on a different path to different root if the server above them was incorrect. It is one of the more fun problems in the whole name/directory service space.
- dvanduzer 13y ago
  DNS SEC doesn't seem any closer to solving this problem, unfortunately. Do you know of any designs that require a quorum at each level prior to trust? BitCoin seems to be having success with this model, but I'm wondering if anyone's built something like that with the primary intent of creating a directory service.
  - ChuckMcM 13y ago
    I don't think they have, much of the work on directory services died when people gave up. DNS was "too hard" to change and Microsoft wasn't going to let anything make into a standard that killed off the need for Active Directory. The LDAP guys, being formerly X.500 guys, went off solving a different problem and ended up somewhat stuck between AD and DNS. Sad really. That said, your idea about poaching the Bitcoin quorum ideas is a good one. Essentially a data structure, equivalent to the block chain, where it only gets authenticated if enough people ack that its the most valid version of reality. Probably a publishable paper in exploring that question.
quackerhacker 13y ago
I think confluence-networks.com may be apart of Network Solutions (which is whom LinkedIn is registered with). I had a domain (nitren.com), that I let expire after 3yrs and confluence-networks.com back ordered it, I remember looking it up a while back, but if I remember right, all the ip and domains were registered or associated with netsol.
- dukekarthik 13y ago
  confluence-networks.com is part of DirectI. See http://www.directi.com http://www.directi.com
kcthota 13y ago
fidelity.com is also not accessible. Currently traffic is routed to some domain parking page.
- jes 13y ago
  Appears to be corrected at this time.
  - meatmanek 13y ago
    It depends what nameserver you're using. At this time, I see bad results from 3 nameservers on http://www.whatsmydns.net/#A/fidelity.com http://www.whatsmydns.net/#A/fidelity.com It seems this website chooses a random selection from a larger pool of nameservers, so if you refresh the page you may get different results.
fixxer 13y ago
I'm done with LinkedIn. I've been on the fence about it for a year now. I get more recruiter spam than value. I'm also a bit too old for the schadenfreude that accompanies news of my overpaid friends getting canned. I'm running my own race these days and I've never been happier since I stopped comparing my lot in life to the few lucky SOBs I know that survived the cull of sub-prime. I think a better strategy is (1) your own domain and/or (2) a site on github with actual code to validate* your talents. *I hate those "Joe Schmo supported you skill in [insert banal technical skill here]" messages. I once put down C++ because I had been working with it for a couple years. Then, I thought better (I would not take a C++ programming job. Period. Hate that language.) and took it off. Next thing I know, I've got coworkers supporting my C++ acumen and LinkedIn trying to push it back on my profile. Ugh. I call that invasive feature creep. On top of that, they seem to leave the backdoor open a bit too much for a company with $20b market cap.
- littledot5566 13y ago
  >I think a better strategy is (1) your own domain and/or (2) a site on github with actual code to validate* your talents. That's because their target audience is not restricted to the tech savvy. Not everyone knows how to host and maintain their own domain. Not everyone uses github or know what git is. This was basically why LinkedIn came into fruition in the first place.
  - fixxer 13y ago
    I totally get it. I'm only talking about me. I'm sure this community is generally capable of rolling their own LinkedIn.
    - imdsm 13y ago
      I chose both routes. I don't particularly like like LinkedIn, but if it helps me network¹ then it's a positive tool to have until I no longer need it. ¹ yes, I also hate that word, but there you go.
- pinaceae 13y ago
rsamvit 13y ago
Sigh. At least they didn't leak plaintext passwords again
- gergles 13y ago
  When did they ever leak plaintext passwords before? If you're referring to the event a year ago, that was unsalted MD5 hashes (obviously not great, but let's not hyperbolize.)
- dclowd9901 13y ago
  The leaked passwords were hashed and unassociated with emails.
sam152 13y ago
Can someone examine the cookies that they set and tell if there is any sensitive information (passwords?) that are hashed in there? Should we consider this a password breach?
- 699 13y ago
  no
tomasien 13y ago
Watershed moment for ADN?
nikcub 13y ago
This isn't over yet - press dot linkedin.com (dont go there) is still pointing to the rogue server at 204.11.56.17 I'm trying to find other subdomains that might be still pointing there. edit: i'm enumerating all the linkedin.com hosts using a dict. 80% of A records are returning the rogue IP 204.11 edit: 96 records still pointing at the rogue server, here is a dump I just uploaded: http://pastebin.com/uc2JXPfB http://pastebin.com/uc2JXPfB
- meatmanek 13y ago
  What nameserver are you using?
  - nikcub 13y ago
    against their primary NS ns1.linkedin.com short TTL's on a lot of these domains I just ran it again this time using Google name servers and still a lot of subdomains are pointing to the 214 server. confirmed it running against their NS, which means it hasn't been changed yet.
    - wavefunction 13y ago
      I've got my nameservice hardset through openDNS and it's resolving to 198.55.195.121, which is allocated to NASDAQ OMX according to ARIN... The 214.-.-.- is some British Virgin Islands allocation?
      - nikcub 13y ago
        I just got a message on twitter that 214.11 might be a DDoS mitigation service.. have emailed linkedin to find out what is what.
kyllo 13y ago
Can they actually snarf cookies from other sites you're logged into, or would they only be able to get at your LinkedIn session cookies?
- bcl 13y ago
  No. Cookies only get sent to the originating domain. What happened here is *.linkedin.com points to the rogue server so your cookies get passed to them instead of the real Linkedin.
mtam 13y ago
LinkedIn seems to be back online.
shuw 13y ago
https://linkedin.com https://linkedin.com 301s to http://linkedin.com http://linkedin.com for me. Should I be suspicious or do browsers validate the certificate even during re-directs?
- gergles 13y ago
  The certificate is validated before the 301 is sent.
Xanza 13y ago
HTTPS everywhere; that's all I have to say. Something like this is very malicious and very hard to detect -- unless you ALWAYS use SSL. I noticed right away that the DNS was incorrect.
surjithctly 13y ago
What a Hacking Idea. Seriously!
NKCSS 13y ago
I just realised; If you opened a website with a linked in share button, your cookie might be compromised as well; you didn't even have to go the the site while under the DNS Hijack...
leke 13y ago
Weren't they asking for your email passwords the other day?
voidlogic 13y ago
http://confluence-networks.com/ http://confluence-networks.com/: Important Notice [20th June, 2013] Confluence Networks is a Colocation & Network service provider having tie-ups with data centers across various geographical regions. We don't host any services ourselves. Starting few hours ago, we received reports about some sites (including linkedin.com) pointing to IPs allotted to our ranges. We are in touch with the affected parties & our customer to identify the root cause of this event. Note that it has already been verified that this issue was caused due to a human error and there was NO security related issue caused by the same. More details will be provided shortly.
danyork 13y ago
LinkedIn has posted a statement pointing over to "the company that manages our domain" - http://linkd.in/12XMvpu http://linkd.in/12XMvpu

210 points by mikegreenspan 13y ago

TheBurningOr 13y ago

Does anyone have any corroboration of this?

moondogg 13y ago
http://www.cio.co.ke/news/main-stories/google,-microsoft,-linkedin-hacked-in-kenyan-dns-hijack http://www.cio.co.ke/news/main-stories/google,-microsoft,-li...
- glanotte 13y ago
  That is from April 15th.
meatmanek 13y ago
https://twitter.com/LinkedIn/status/347530092886519808 https://twitter.com/LinkedIn/status/347530092886519808

meritt 13y ago

Seeing 204.11.56.17 for their A record which is OrgName: Confluence Networks Inc OrgId: CN Address: 3rd Floor, Omar Hodge Building, Wickhams Address: Cay I, P.O. Box 362 City: Road Town StateProv: Tortola PostalCode: VG1110 Country: VG RegDate: 2011-04-07 Updated: 2011-07-05

mindcrime 13y ago
I'm getting 216.52.242.80. Looks legit: [prhodes@captainchaos ~]$ whois 216.52.242.80@whois.arin.net [Querying whois.arin.net] [whois.arin.net] # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # # Query terms are ambiguous. The query is assumed to be: # "n 216.52.242.80" # # Use "?" to get help. # # # The following results may also be obtained via: # http://whois.arin.net/rest/nets;q=216.52.242.80? showDetails=true&showARIN=false&ext=netref2 # LinkedIn Corporation INAP-LAX-LINKEDIN-38682 (NET-216-52- 242-0-1) 216.52.242.0 - 216.52.242.255 Internap Network Services Corporation PNAP-8-98 (NET-216-52-0-0-1) 216.52.0.0 - 216.52.255.255
antsam 13y ago
Doing an nslookup here in Vancouver, Canada got me this: Non-authoritative answer: Name: linkedin.com Address: 216.52.242.86 Does that mean I'm still pointing to the legitimate server?

hnolable 13y ago

I guess they didn't mark their cookies as 'Secure'. Oh well, the real story here is an app.net link at #1 on HN.

chollida1 13y ago
> Oh well, the real story here is an app.net link at #1 on HN. I can't tell if this is sarcasm or a serious comment. Could you elaborate on this comment? I don't get why a link by app.net would be news worthy.
- heroic 13y ago
  I guess because it's not twitter!
- hnolable 13y ago
  My understanding is app.net is trying to be a paid version of twitter. There was/is much debate whether it could ever take off. This is the first time I've ever seen someone link to it. Although now I realize that the link is to the app.net cofounder so that doesn't really say much.
  - millzlane 13y ago
    OP works there according to his twitter feed.
coderrr 13y ago
Looks like app.net isn't perfect either. Their HSTS isn't implemented correctly. Only 'alpha.app.net' and 'join.app.net' are protected while 'app.net' is not. They fell into one of the common pitfalls with their http->https redirects: http://coderrr.wordpress.com/2010/12/27/canonical-redirect-pitfalls-with-http-strict-transport-security-and-some-solutions/ http://coderrr.wordpress.com/2010/12/27/canonical-redirect-p... You can verify this at: chrome://net-internals/#hsts
asdfaoeu 13y ago
> Oh well, the real story here is an app.net link at #1 on HN. Looks like the app.net post was by a founder so I would take that with a grain of salt. Edit: While I'm at it according to https://twitter.com/mikegreenspan https://twitter.com/mikegreenspan , the submitter also works at app.net.

somid3 13y ago

well, certainly the photo upload still is not working, you can update your photo via their website apparently.

kcen 13y ago

The DNS was not exactly hijacked, there were issues inside of LinkedIn's top level DNS provider whom were delegating www.linkedin.com authorization to unauthorized nameservers, namely NS[SOMETHING].ztomy.com. The ztomy DNS replaces its delegated domains to point to a domain parking page if there is no record exiting. These changes were then propagated to other nameservers and thus to the end user. End result, dns doesn't point where you think it does.

gravitronic 13y ago
That makes sense since we just saw the same problem with USPS realtime shipping rates via production.shippingapis.com, which seems like an odd attack target. edit: and I mean the exact same issue, it was resolving to a confluence owned IP that was serving a squatter page for the domain.
inopinatus 13y ago
Au contraire; having the delegation going somewhere unwanted is practically the definition of a DNS hijack. The question is - how did that happen? A malicious third party? a blundering sysadmin? or a bug in some provisioning code? It does sound like LinkedIn's NOC are playing the blame game already. Well, I guess they've gotta get all those spamming recruiters & sales reps back online. EDIT: heh, maybe it was The New Guy: http://www.simplyhired.com/job-id/y5bvoz46k6 http://www.simplyhired.com/job-id/y5bvoz46k6
- kcen 13y ago
  It's always the new guy, f'n new guy.
- yannk 13y ago
  ahaha, the job posting is a good find. We'll know if you are right if tomorrow a different add asking for "Total badass, Expert guru knowledge of Bind 9"
dsl 13y ago
You used a lot of the right words, but not in the right context. Could you share your source do we can get the full picture?

raldi 13y ago

Can anyone think of a good reason LinkedIn didn't mark their cookies as HTTPS-only? http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

Raticide 13y ago
They forgot?
dsl 13y ago
I often describe LinkedIn as a bunch of business people, who have a website. It's not a tech company and the hiring reflects that.
- mncaudill 13y ago
  Seriously? http://blog.linkedin.com/2011/01/11/open-source-linkedin-kafka/ http://blog.linkedin.com/2011/01/11/open-source-linkedin-kaf... http://blog.linkedin.com/2009/03/20/project-voldemort-scaling-simple-storage-at-linkedin/ http://blog.linkedin.com/2009/03/20/project-voldemort-scalin...
- darth_aardvark 13y ago
  I was an engineering intern there for a summer. The interviews were as difficult as any other tech company in the valley, as was the workload. It is most certainly a tech company.
- memmove 13y ago
  dsl, no offense, but you seem to have a problem with any company that doesn't hire/provide employment to your average local community college CS grad and instead hires globally based purely on merit. Linkedin interviews are on par with facebook/google et al.
  - dsl 13y ago
    Really, now the sock puppets are coming out? I hire people purely on technical merit, I don't even bother reviewing educational credentials. I am opposed to abusing the H1-B system rather than opening offices overseas to bring in skilled labor and raise local standards of living.

bryanh 13y ago

Was api.linkedin.com compromised/hijacked? If so, that means they'll need to reset a lot of OAuth token/secrets which will be very painful indeed (worse than just a site-wide session reset).

kcen 13y ago
Isn't that the point of OAuth? (versus HTTP basic auth) Your secret key shouldn't be compromised, because you're supposed to keep that secret. Also if you use HTTPS for requests you'd still get a cert error even if DNS was routing incorrectly. You're probably fine.
- bryanh 13y ago
  Indeed, I misspoke and meant to say tokens/refresh tokens. A similar thing happened for Evernote a while back and knocked down all tokens and required re-authentication across the board.

ioquatix 13y ago

I'm going to blatantly advertise my own project "RubyDNS" - it can be a lot of fun, and it is especially relevant because it allows you to perform these kinds of attacks in a controlled environment. http://www.codeotaku.com/projects/rubydns/index.en http://www.codeotaku.com/projects/rubydns/index.en

dsl 13y ago
Have you played with PowerDNS? It would be awesome to see RubyDNS rewritten as a backend.
- ioquatix 13y ago
  Yeah, I've looked at it briefly. Well, RubyDNS already provides the full DNS server functionality, so I didn't really see the point. What do you think the main benefits would be?

mtam 13y ago

My traceroute is going thru prolexic.com so there might be something else at play here. "Prolexic is the world’s largest and most trusted distributed denial of service (DDoS) mitigation service provider"

mattbarrie 13y ago

Seems legit. www.ztomy.com

dsl 13y ago
ztomy.com is part of the DirectI/ResellerClub/etc. group of companies. They operate paid domain parking programs for registrars.

willlll 13y ago

How has app.net adoption been going?

thrownaway2424 13y ago

I guess it's a good thing I never reset my LinkedIn password after they lost them all, so I don't have a LinkedIn account to be hijacked.

krapp 13y ago

Someone turned off the 'more magic' switch...

djabatt 13y ago

DNS hacks on big public companies seems like a big security oversite form the linkedin team. wow. Perhaps my HTTPS anywhere extension could have helped folks.

DoubleMalt 13y ago
While I love your HTTPS anywhere extension and thought (cough) have it installed, I was dismayed that I was allowed to connect to http://www.linkedin.com/ http://www.linkedin.com/. Then I found out it wasn't synched over last time I changed laptops. Installing it now. Thanks for the great work!
jgh 13y ago
Is HTTPS Anywhere better than HTTPS Everywhere?

ChuckMcM 13y ago

Random anecdote: One of the DNS issues I tried to fix with NIS+ was the 'maintaining a list of trusted servers' problem by distributing the management of the authoritative servers. Trust was built bottom up, and authority came top down. The way it worked was that clients used a 'coldstart' file which was the (small number) of servers you trusted to provide your namespace lookups. You to their public key and you put it into your coldstart file. Similarly, a server put the key(s) of the servers it trusted above it in the name space in its coldstart file. And at company 'root' level was a set of servers run by a trusted authority. Locating the authoritative name server for x.y.z from p.q.z (same as DNS root is rightmost) client in x.y.z asks its server for a trusted y.z server, gets it, and asks that server for a trusted z. server, then asks that server for a q.z. server and finally for a p.q.z. server. Once this has happened once you know trusted servers can can jump to the nearest one to start resolving a new path in the namespace. It was slower on initial lookup and then just as fast as DNS on later ones. It had the downside that compromised (or borked) high level servers could send you on a different path to different root if the server above them was incorrect. It is one of the more fun problems in the whole name/directory service space.

dvanduzer 13y ago
DNS SEC doesn't seem any closer to solving this problem, unfortunately. Do you know of any designs that require a quorum at each level prior to trust? BitCoin seems to be having success with this model, but I'm wondering if anyone's built something like that with the primary intent of creating a directory service.
- ChuckMcM 13y ago
  I don't think they have, much of the work on directory services died when people gave up. DNS was "too hard" to change and Microsoft wasn't going to let anything make into a standard that killed off the need for Active Directory. The LDAP guys, being formerly X.500 guys, went off solving a different problem and ended up somewhat stuck between AD and DNS. Sad really. That said, your idea about poaching the Bitcoin quorum ideas is a good one. Essentially a data structure, equivalent to the block chain, where it only gets authenticated if enough people ack that its the most valid version of reality. Probably a publishable paper in exploring that question.

quackerhacker 13y ago

I think confluence-networks.com may be apart of Network Solutions (which is whom LinkedIn is registered with). I had a domain (nitren.com), that I let expire after 3yrs and confluence-networks.com back ordered it, I remember looking it up a while back, but if I remember right, all the ip and domains were registered or associated with netsol.

dukekarthik 13y ago
confluence-networks.com is part of DirectI. See http://www.directi.com http://www.directi.com

kcthota 13y ago

fidelity.com is also not accessible. Currently traffic is routed to some domain parking page.

jes 13y ago
Appears to be corrected at this time.
- meatmanek 13y ago
  It depends what nameserver you're using. At this time, I see bad results from 3 nameservers on http://www.whatsmydns.net/#A/fidelity.com http://www.whatsmydns.net/#A/fidelity.com It seems this website chooses a random selection from a larger pool of nameservers, so if you refresh the page you may get different results.

fixxer 13y ago

I'm done with LinkedIn. I've been on the fence about it for a year now. I get more recruiter spam than value. I'm also a bit too old for the schadenfreude that accompanies news of my overpaid friends getting canned. I'm running my own race these days and I've never been happier since I stopped comparing my lot in life to the few lucky SOBs I know that survived the cull of sub-prime. I think a better strategy is (1) your own domain and/or (2) a site on github with actual code to validate* your talents. *I hate those "Joe Schmo supported you skill in [insert banal technical skill here]" messages. I once put down C++ because I had been working with it for a couple years. Then, I thought better (I would not take a C++ programming job. Period. Hate that language.) and took it off. Next thing I know, I've got coworkers supporting my C++ acumen and LinkedIn trying to push it back on my profile. Ugh. I call that invasive feature creep. On top of that, they seem to leave the backdoor open a bit too much for a company with $20b market cap.

littledot5566 13y ago
>I think a better strategy is (1) your own domain and/or (2) a site on github with actual code to validate* your talents. That's because their target audience is not restricted to the tech savvy. Not everyone knows how to host and maintain their own domain. Not everyone uses github or know what git is. This was basically why LinkedIn came into fruition in the first place.
- fixxer 13y ago
  I totally get it. I'm only talking about me. I'm sure this community is generally capable of rolling their own LinkedIn.
  - imdsm 13y ago
    I chose both routes. I don't particularly like like LinkedIn, but if it helps me network¹ then it's a positive tool to have until I no longer need it. ¹ yes, I also hate that word, but there you go.
pinaceae 13y ago

rsamvit 13y ago

Sigh. At least they didn't leak plaintext passwords again

gergles 13y ago
When did they ever leak plaintext passwords before? If you're referring to the event a year ago, that was unsalted MD5 hashes (obviously not great, but let's not hyperbolize.)
dclowd9901 13y ago
The leaked passwords were hashed and unassociated with emails.

sam152 13y ago

Can someone examine the cookies that they set and tell if there is any sensitive information (passwords?) that are hashed in there? Should we consider this a password breach?

699 13y ago
no

tomasien 13y ago

Watershed moment for ADN?

nikcub 13y ago

This isn't over yet - press dot linkedin.com (dont go there) is still pointing to the rogue server at 204.11.56.17 I'm trying to find other subdomains that might be still pointing there. edit: i'm enumerating all the linkedin.com hosts using a dict. 80% of A records are returning the rogue IP 204.11 edit: 96 records still pointing at the rogue server, here is a dump I just uploaded: http://pastebin.com/uc2JXPfB http://pastebin.com/uc2JXPfB

meatmanek 13y ago
What nameserver are you using?
- nikcub 13y ago
  against their primary NS ns1.linkedin.com short TTL's on a lot of these domains I just ran it again this time using Google name servers and still a lot of subdomains are pointing to the 214 server. confirmed it running against their NS, which means it hasn't been changed yet.
  - wavefunction 13y ago
    I've got my nameservice hardset through openDNS and it's resolving to 198.55.195.121, which is allocated to NASDAQ OMX according to ARIN... The 214.-.-.- is some British Virgin Islands allocation?
    - nikcub 13y ago
      I just got a message on twitter that 214.11 might be a DDoS mitigation service.. have emailed linkedin to find out what is what.

kyllo 13y ago

Can they actually snarf cookies from other sites you're logged into, or would they only be able to get at your LinkedIn session cookies?

bcl 13y ago
No. Cookies only get sent to the originating domain. What happened here is *.linkedin.com points to the rogue server so your cookies get passed to them instead of the real Linkedin.

mtam 13y ago

LinkedIn seems to be back online.

shuw 13y ago

https://linkedin.com https://linkedin.com 301s to http://linkedin.com http://linkedin.com for me. Should I be suspicious or do browsers validate the certificate even during re-directs?

gergles 13y ago
The certificate is validated before the 301 is sent.

Xanza 13y ago

HTTPS everywhere; that's all I have to say. Something like this is very malicious and very hard to detect -- unless you ALWAYS use SSL. I noticed right away that the DNS was incorrect.

surjithctly 13y ago

What a Hacking Idea. Seriously!

NKCSS 13y ago

I just realised; If you opened a website with a linked in share button, your cookie might be compromised as well; you didn't even have to go the the site while under the DNS Hijack...

leke 13y ago

Weren't they asking for your email passwords the other day?

voidlogic 13y ago

http://confluence-networks.com/ http://confluence-networks.com/: Important Notice [20th June, 2013] Confluence Networks is a Colocation & Network service provider having tie-ups with data centers across various geographical regions. We don't host any services ourselves. Starting few hours ago, we received reports about some sites (including linkedin.com) pointing to IPs allotted to our ranges. We are in touch with the affected parties & our customer to identify the root cause of this event. Note that it has already been verified that this issue was caused due to a human error and there was NO security related issue caused by the same. More details will be provided shortly.

danyork 13y ago

LinkedIn has posted a statement pointing over to "the company that manages our domain" - http://linkd.in/12XMvpu http://linkd.in/12XMvpu